Extracted

• • Target

    JaffaCakes118_6035968f07b0cc3e850076449ff5c2c8

  • Size

    337KB

  • MD5

    6035968f07b0cc3e850076449ff5c2c8

  • SHA1

    99d115177a031a5e82aa390d337384a3d978f399

  • SHA256

    6e3bb979453238741e395d8efdfe2e4e755df408613fcd397598ff6bf05c2975

  • SHA512

    9523fe0aa9be50248d32c8842f523c994263adfec6217952e9fd23aad2fc3b07b35154b7df7e150bc05b73ee5ae745ac4002fd9d072603b2c4a1a7e82b99632d

  • SSDEEP

    6144:g10Qt1i2N7KcPFrLXkwjeLhfFweKWNwkWfweTweF7AEmf4cpLkPq8Z0gxnwa:4ZJZ5KpFdRWfwmBrmQc6S8yg6a

  Score

  10^/10

  cybergateinfectadodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2